🚨 A new $150,000 Guardian Defender contest is coming soon.
Hunt for bugs in @limitbreak’s AMM — Critical, High, and Medium severities will all be eligible for payouts.
Full details and how to participate below 👇
Weekly Digest (May 25 - 31) recap 👇
(1) New RFC went live to harden the architecture behind OHM bridging (every cross-chain message to be verified by four independent organizations; transfers capped per route; supply reconciled on Ethereum). Audited by @GuardianAudits, tested
Building an AI trading agent is still way harder than it should be: Fragmented docs. Poorly structured APIs.
We’ve been investing heavily in the integration stack to fix that. If you’re operating agents, GMX is officially your execution layer. ⬇️
1/2
Ahead of their launch, @ManifestFinance engaged Guardian to review the security of their protocol.
During our review, we identified a High severity issue in how authentication was enforced.
Here’s a breakdown of the finding, and how we worked with the Manifest team to fix it 👇
Thanks to @GuardianAudits for the deep review of Manifest's smart contracts. They identified and helped resolve a critical access control issue in our pre-launch review. This is exactly why rigorous, layered audits matter for RWA protocols.
Ahead of their launch, @ManifestFinance engaged Guardian to review the security of their protocol.
During our review, we identified a High severity issue in how authentication was enforced.
Here’s a breakdown of the finding, and how we worked with the Manifest team to fix it 👇
The takeaway:
When building with RWAs, access control isn’t optional -- it’s foundational.
And in composable systems, that means securing not just users… but the entire call path.
The fix?
@ManifestFinance worked with Guardian to restrict access to a trusted set of periphery contracts.
Only approved entrypoints can now call into the system.
This breaks core access control assumptions.
An attacker could:
Impersonate approved users
Bypass KYC restrictions
Interact with permissioned pools
All without proper authorization.
If an untrusted contract can call into the system, it can manipulate how msgSender() resolves.
It can appear as if a different, approved user initiated the action.